The correct answer is B because sensitive account lookup must be gated deterministically. A custom variable can store verification status, and an available when filter can make the lookup action invisible until that status is true. This prevents the LLM from even seeing or selecting the protected action before verification succeeds. Option A misuses Prompt Defense; prompt defense helps protect against unsafe prompt behavior, but it does not replace action-level authorization. Option C is unreliable because natural language instructions are still interpreted by the model and do not enforce execution control. Salesforce release guidance states that filters can be created for topics and actions so the agent can use them only when conditions are met. Variables are also used in filters and action control.